From a6fa148cb6833caf680502974c2bbfd1e87109cd Mon Sep 17 00:00:00 2001 From: Aaron Trowbridge Date: Fri, 3 Jul 2026 17:17:54 -0400 Subject: [PATCH] ci: authenticate the private-fork binary fetch with a cross-repo token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fast, vsix-gate, and boot-smoke jobs pull the vendored opencode binary from the PRIVATE harmoniqs/opencode release via `gh release download`. The default Actions GITHUB_TOKEN is scoped to this repo only, so gh is unauthed for harmoniqs/opencode and the download fails (exit 1) — reddening every PR since #77 made the binary fetch unskippable. Pass a cross-repo token (repo secret OPENCODE_FETCH_TOKEN) as GH_TOKEN to the three binary-fetching steps. gh reads GH_TOKEN from env; the fetch_opencode.mjs subprocess inherits it. REQUIRES the OPENCODE_FETCH_TOKEN secret to be set before this goes green (fine-grained PAT: harmoniqs/opencode, Contents: read). Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe3cb610..044aa40d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,11 @@ jobs: # self-skipping — the skip was the #25 CI-level false-green (an injection or # config-merge regression would pass CI because the only test for it skipped). - run: pnpm --filter amicode-v2 fetch:opencode + env: + # gh release download pulls the vendored binary from the PRIVATE + # harmoniqs/opencode release; the default GITHUB_TOKEN is scoped to + # this repo only, so gh needs a cross-repo token (see repo secret). + GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }} - run: pnpm -r run test # amico-run suite (incl. S31 grep rule) + extension unit suite (incl. the opencode inject/merge integration) + @amicode/schema conformance - name: amico-validate — shipped configs conform + linked bin works (0.1c gate) run: | @@ -71,6 +76,8 @@ jobs: with: { node-version: 20, cache: pnpm } - run: pnpm install --frozen-lockfile - run: pnpm --filter amicode-v2 package # amico-run build + ext build + fetch:opencode + vsce + env: + GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }} # package → fetch:opencode pulls the private binary - run: AMICODE_REQUIRE_VSIX=1 pnpm --filter amicode-v2 exec vitest run test/packaging.test.ts boot-smoke: strategy: @@ -84,4 +91,6 @@ jobs: with: { node-version: 20, cache: pnpm } - run: pnpm install --frozen-lockfile - run: pnpm --filter amicode-v2 fetch:opencode + env: + GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }} - run: pnpm --filter amicode-v2 test:smoke